From support@us.external.hp.com Thu Sep 12 20:55:47 1996
Date: Thu, 12 Sep 1996 17:40:38 -0700
From: HPSL Mail Service
Reply-To: support-feedback@us.external.hp.com
To: security_info_4@us.external.hp.com
Subject: RE: Security Bulletins Digest
--------
===============================================================================
***HP SupportLine Mail Service Notice***
This digest contains a summary of all newly received Security Bulletins.
You do not have to have any form of support from Hewlett-Packard to subscribe
to this digest or to procure the recommended patches via the HP SupportLine
mail service.
-------------------------------------------------------------------------------
To obtain a copy of the HP SupportLine mail service user's guide, send the
following (in the TEXT PORTION OF THE MESSAGE to) to the HP SupportLine mail
service.
To: support@us.external.hp.com
Message Text:
send guide
-------------------------------------------------------------------------------
To obtain a patch identified within this Security Bulletin, send the following
(in the TEXT PORTION OF THE MESSAGE) to the HP SupportLine mail service.
To: support@us.external.hp.com
Message Text:
send xxxxxxxxxxxx
(where xxxxxxxxxxxx represents the specified patch name).
-------------------------------------------------------------------------------
If you have concerns about security issues, please forward them to:
security-alert@hp.com
The security-alert node is monitored during working hours Pacific Daylight Time
by multiple HP Security Response Team personnel. We reply to your message only
if necessary to obtain additional information.
-------------------------------------------------------------------------------
If you would like to be REMOVED from this mailing lists, send the following (in
the TEXT PORTION OF THE MESSAGE) to the HP SupportLine mail service.
To: support@us.external.hp.com
Message Text:
unsubscribe security_info
===============================================================================
Digest Name: security_info
Description: Daily Security Bulletins Digest
Created: Thu Sep 12 16:46:16 1996 PDT
-------------------------------------------------------------------------------
Summary of 'Daily Security Bulletins Digest' documents
-------------------------------------------------------------------------------
Document Id Description Page 1
-------------------------------------------------------------------------------
HPSBUX9609-038 Security Vulnerability in HP VUE3.0
===============================================================================
Detailed list of 'Daily Security Bulletins Digest' documents
===============================================================================
Document Id: [HPSBUX9609-038]
Date Loaded: [09-12-96]
Description: Security Vulnerability in HP VUE3.0
===============================================================================
-------------------------------------------------------------------------
HEWLETT-PACKARD SECURITY BULLETIN: HPSBUX9609-038, 10 September 1996
-------------------------------------------------------------------------
The information in the following Security Bulletin should be acted upon
as soon as possible. Hewlett Packard will not be liable for any
consequences to any customer resulting from customer's failure to fully
implement instructions in this Security Bulletin as soon as possible.
-------------------------------------------------------------------------
PROBLEM: Using Vue 3.0 on only HP-UX releases 10.01 and 10.10 it is
possible to increase privileges and launch denial of service
attacks.
PLATFORM: HP 9000 series 700/800 systems running only versions 10.01 and
10.10 of HP-UX
DAMAGE: Increased privilege and denial of service.
SOLUTION: Apply patch PHSS_7752 (HP-UX 10.01), or
PHSS_7753 (HP-UX 10.10), or
update to HP-UX release 10.20.
AVAILABILITY: All patches are available now.
-------------------------------------------------------------------------
I. VUE
A. Background
Hewlett-Packard has found problems in the Visual User Environment
(VUE3.0) version shipped with currently supported HP-UX releases
on HP9000 series 700/800.
B. Fixing the problem
The above patches for the fileset X11.VUE-RUN were created to
eliminate the problem with VUE3.0. This vulnerability can be
eliminated by installing the patches referenced herein.
C. Impact of the patch
The patches provide a new version of the necessary executables
to fix the vulnerability. Installation instructions are contained
within the patches.
D. To subscribe to automatically receive future NEW HP Security
Bulletins from the HP SupportLine mail service via electronic
mail, send an email message to:
support@us.external.hp.com (no Subject is required)
Multiple instructions are allowed in the TEXT PORTION OF THE
MESSAGE, here are some basic instructions you may want to use:
To add your name to the subscription list for new security
bulletins, send the following in the TEXT PORTION OF THE MESSAGE:
subscribe security_info
To retrieve the index of all HP Security Bulletins issued to
date, send the following in the TEXT PORTION OF THE MESSAGE:
send security_info_list
To get a patch matrix of current HP-UX and BLS security
patches referenced by either Security Bulletin or Platform/OS,
put the following in the text portion of your message:
send hp-ux_patch_matrix
World Wide Web service for browsing of bulletins
is available via our URL:
(http://us.external.hp.com)
Choose "Support news", then under Support news,
choose "Security Bulletins"
E. To report new security vulnerabilities, send email to
security-alert@hp.com
Please encrypt exploit information using the security-alert PGP
key, available from your local key server, or by sending a
message with a -subject- (not body) of 'get key' (no quotes) to
security-alert@hp.com.
Permission is granted for copying and circulating this Bulletin to
Hewlett-Packard (HP) customers (or the Internet community) for the
purpose of alerting them to problems, if and only if, the Bulletin is
not edited or changed in any way, is attributed to HP, and provided
such reproduction and/or distribution is performed for non-commercial
purposes.
Any other use of this information is prohibited. HP is not liable
for any misuse of this information by any third party.
________________________________________________________________________